[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-125":3},{"item":4,"lessons":16,"controls":38,"related":62},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-125","SP 800-125","SP 800-125: Guide to Security for Full Virtualization Technologies",5,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on the security of full virtualisation, where hypervisors run complete guest operating systems. It covers threats to hypervisors, guest operating systems and virtual networks, and recommendations for planning and deploying virtualised environments securely.\n\n**In practice.** Applying it well means hardening and patching hypervisors, restricting and protecting administrative access to the virtualisation management layer, separating management networks and controlling how virtual machines are created, copied and retired. Evidence includes hypervisor configuration standards, access controls on management consoles and inventories of virtual machines.\n\n**Common gaps.** Typical gaps are management interfaces reachable from general networks, dormant virtual machines left unpatched and broad administrator rights over the whole virtual estate. The guide dates from 2011, so it predates many cloud practices.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"pwnescape-linux-kernel-flaw-allows-guest-vms-to-read-host-memory","PwnEscape: Linux Kernel Flaw Allows Guest VMs to Read Host Memory","2026-10-15T22:20:53.307+00:00",{"slug":23,"title":24,"published_at":25},"linux-kernel-vhost-flaw-grants-root-and-enables-vm-escape","Linux Kernel vhost Flaw Grants Root and Enables VM Escape","2026-10-14T10:21:04.498+00:00",{"slug":27,"title":28,"published_at":29},"critical-vmware-hypervisor-escapes-demand-immediate-patching","Critical VMware Hypervisor Escapes Demand Immediate Patching","2026-09-04T12:20:42.072+00:00",{"slug":31,"title":32,"published_at":33},"16-year-old-linux-kernel-flaw-enables-vm-escape-on-intel-and-amd","16-Year-Old Linux Kernel Flaw Enables VM Escape on Intel and AMD","2026-07-07T14:22:36.457+00:00",{"slug":35,"title":36,"published_at":37},"16-year-old-linux-kvm-hypervisor-flaw-enables-vm-escape-to-host","16-Year-Old Linux KVM Hypervisor Flaw Enables VM Escape to Host","2026-07-06T20:21:00.526+00:00",[39,44,48,52,57],{"slug":40,"name":41,"problem":42,"stories":43},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":45,"name":46,"problem":47,"stories":43},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":49,"name":50,"problem":51,"stories":43},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":53,"name":54,"problem":55,"stories":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",2,{"slug":58,"name":59,"problem":60,"stories":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",1,[63,68,72,77,81,85,90,95],{"family":64,"item":65,"code":66,"title":67,"together":9},"cis","7","Control 7","Continuous Vulnerability Management",{"family":69,"item":70,"code":71,"title":71,"together":9},"itil","overview","ITIL",{"family":73,"item":74,"code":75,"title":76,"together":9},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":73,"item":78,"code":79,"title":80,"together":43},"sc-39","SC-39","Process Isolation",{"family":73,"item":82,"code":83,"title":84,"together":43},"ac-6","AC-6","Least Privilege",{"family":64,"item":86,"code":87,"title":88,"together":89},"12","Control 12","Network Infrastructure Management",3,{"family":91,"item":92,"code":93,"title":94,"together":89},"gdpr","32","Article 32","Security of processing",{"family":64,"item":96,"code":97,"title":98,"together":89},"4","Control 4","Secure Configuration of Enterprise Assets and Software"]